A value is data; sed's replacement is code — cheat sheet

text=$(<"$TEMPLATE")                       # read a file into a variable
text=${text//@DB_HOST@/"$DB_HOST"}         # literal replacement, no escaping needed
printf '%s\n' "$text" > "$tmp"             # never printf "$text"

unset DB_HOST DB_PASSWORD; . "$VALUES"     # no leftovers from the environment
: "${DB_HOST:?DB_HOST is not set in $VALUES}"

umask 077                                  # before creating anything that holds a secret
tmp=$(mktemp "$OUT.XXXXXX"); trap 'rm -f -- "$tmp"' EXIT
chmod 600 "$tmp"; mv -f -- "$tmp" "$OUT"

# sed's replacement: & = whole match, \1..\9 = groups, \ escapes, delimiter ends the command
systemctl status unit          # ExecStartPre= failures are shown separately from ExecStart=